The code is rather straightforward. It reads packed width/height of the image, receives image with colors converted to bits (instead of 0-255 values) and packed to bytes (each byte = 8 pixels of the image). Then it reads QRCodes from it and calls fprintf on each message. Here’s this part of code:

There’s some_magic function which does some conversion and after looking closer it’s easy to see it’s actually base64decode. You can hope so until you find that it contains some mistakes:

buffer is zeroed only before reading the whole image, not each symbol and each 2,3 bytes are OR’ed with new data

the last byte (32nd) is decoded only partially – low 4 bits are always zeroes

That means we can’t easily use more than one qrcode in single image (we can use it only if the second value can be got by OR’ing the first with something) and that we have only 31 byte for formatstring.

Let’s first find argument number which points to our buffer. I used libformatstr for that:

We’ve managed to shrink it to 32 bytes, but because of the mistake in base64decode we need no more than 31 byte (or 32nd byte with zeroed lower bits).

But let’s allow us to make format string larger: there’s no explicit null termination, so we can extend our format string on the stack! Easier, we can save addresses to overwrite there, so the format string will be small enough itself:

1 comment

bowknotbowknot says:

is quite a bit more room to slip every one of the details about the shirt.If you are likely to have your band, wear the computer screen printing tee shirt that will be engaging in.If you will have volleyball including a pool, entice people to come basic details.But above all, make sure that must be known that you’ll be the birthday bash girl as well as birthday child and this is usually a special day that you choose to deserve.Tee tshirts also allow you to be far even more creative is quite a bit more room to slip every one of the details about the shirt.If you are likely to have your band, wear the computer screen printing tee shirt that will be engaging in.If you will have volleyball including a pool, entice people to come basic details.But above all, make sure that must be known that you’ll be the birthday bash girl as well as birthday child and this is usually a special day that you choose to deserve.Tee tshirts also allow you to be far even more creative compared to a simple celebration invitation by unit card.If there will likely be a piece performing in your birthday blowout, put an image of any band within the shirt utilizing their logo.In case you are looking to undertake a beach style party, develop a shirt stuffed with color along with palm trees and sand to build the pleasurable.You more than likely fear the fact that having custom t-shirts made just by a house party will likely be expensive, but that is definitely where you stand wrong.Screen printing tee shirts are very cheap at cheaptees.org and so are cheaper better you buy.It is actually a deal which usually nobody can miss making the idea a simply no brain choice to distribute off your special birthday invitations at a tee t-shirt.How often can you receive personal gift invites on t-shirts? Probably under no circumstances.And that is definitely exactly why you should make a person’s birthday someone to remember by using a custom tee shirt invite..